Privacy Policy

Last Updated: April 17, 2026

Effective Date: April 17, 2026

1. Introduction

Welcome to Workforce Productivity Centre ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform for data-driven workforce planning services.

This policy is designed to comply with applicable data protection laws, including the Kenya Data Protection Act (DPA) and the EU General Data Protection Regulation (GDPR).

2. Information We Collect

We collect personal and professional data strictly necessary to provide our services. We do not collect "sensitive personal data" (such as health, racial, or biometric data). The data we collect includes:

• Account Registration Data: When you create an account, we collect your Name and Email Address.
• Service Data: Through forms on our platform, we collect general staff workload data necessary for our platform's analysis and workforce planning tools.

3. Purpose and Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR and Kenya DPA:

• Fulfillment of a Contract: We process your Registration Data and Service Data to set up your user account and to provide the core services of our application — specifically, delivering data-driven workforce planning and analysis.
• User Consent: Where you actively submit workload data via our forms, we process this on the basis of your explicit consent and our contractual obligation to provide the requested analysis. You may withdraw your consent at any time, though this may prevent us from providing certain core services.

4. Data Storage and Third-Party Sharing

We are committed to strict data sovereignty and privacy:

• Data Location: All personal data and workload data are stored securely on servers located entirely within Kenya.
• Zero Third-Party Sharing: We do not share, sell, rent, or trade your personal or organizational data with any third parties. Your data remains strictly within the Workforce Productivity Centre environment.

5. Data Retention and Deletion

• Retention Period: We retain your personal data and workload data only for as long as your account remains active.
• Account Deletion: If you choose to delete your account, all associated personal data and workload data are completely and irreversibly destroyed from our active databases and cannot be retrieved.

6. Data Security Measures

Protecting your data is our highest priority. We implement robust technical and organizational measures to prevent unauthorized access, loss, or data breaches:

• Framework Security: Our platform is powered by the Laravel framework, leveraging its built-in, industry-standard security features against common vulnerabilities (such as SQL injection and Cross-Site Request Forgery).
• Access Control: We utilize strict Role-Based Access Control (RBAC) to ensure that data is only accessible to authorized users based on their specific organizational roles.
• Encryption: Appropriate encryption standards are applied to protect your data both in transit and at rest.
• Active Monitoring: We actively and continuously monitor our systems for unauthorized access, vulnerabilities, and potential security breaches.

7. Your Data Protection Rights

Under the GDPR and Kenya DPA, you possess exceptional rights regarding your personal data. You have the right to:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request the deletion of your account and associated data at any time.
• Right to Restrict Processing: Request that we temporarily suspend the processing of your data under certain conditions.
• Right to Data Portability: Request an export of your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to the processing of your data where we are relying on a legitimate interest.

To exercise any of these rights, please contact us using the details provided in Section 9. We will respond to your request within the legally mandated timeframe (typically 30 days).

8. Children's Privacy

Our platform is intended for professional use only and is not directed at children. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a child, we will take immediate steps to delete such information.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will notify you of any significant changes by posting the new policy on this page and updating the "Last Updated" date.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact our Data Protection Officer / Privacy Team at:

Workforce Productivity Centre
Physical Address: Nairobi, Kenya
Email Address: privacy@istam.co.ke